CVE-2024-8934

Description

A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.

PUBLISHED Reserved 2024-09-17 | Published 2024-10-31 | Updated 2024-10-31 | Assigner CERTVDE

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Credits

elcazator finder

ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc. reporter

References

cert.vde.com/en/advisories/VDE-2024-064

cve.org (CVE-2024-8934)

nvd.nist.gov (CVE-2024-8934)

Download JSON